EUVD-2026-79839
GHSA-r7x4-874r-rcw5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HFM Security endpoint over network
-
DeliverySend crafted pre-auth SQL/protocol request
-
ExploitBypass authentication (CWE-287)
-
ExecutionObtain administrative control
-
ImpactRead/modify financial data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against the Security component of Oracle Hyperion Financial Management 11.2.26.0.000 (AV:N/AC:L/PR:N/UI:N). Exploitation requires only network access to the affected HFM instance; the description specifies the vector is 'via SQL', suggesting reachability to the application's SQL/network interface. The primary limiting factor is exposure: HFM is an internal enterprise EPM/financial-consolidation system typically deployed behind corporate network boundaries rather than internet-facing, and only the single listed version 11.2.26.0.000 is confirmed affected. |
| Impact | This is a genuine top-priority vulnerability by every intrinsic signal, though real-world exploitation evidence is currently absent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes remote, unauthenticated, low-complexity exploitation with no user interaction yielding full compromise (C:H/I:H/A:H), and CWE-287 (Improper Authentication) plus the description's 'takeover' language confirm this is a true pre-auth authentication bypass rather than a merely high-scored data-exposure bug. This distinguishes it from its near-identical siblings CVE-2026-87175 and CVE-2026-87173 (same product/component/version), which are A:N data-compromise flaws scoring 9.1 - CVE-2026-87184 adds availability impact and reaches full 9.8 takeover. CISA SSVC reinforces urgency: Automatable=yes and Technical Impact=total, meaning an exploit could be reliably scripted for complete control. The one moderating signal is SSVC Exploitation=none, and there is no CISA KEV listing, no public POC, and no EPSS score provided - so severity is high but demonstrated attacker interest is not yet evident. Net: treat as an emergency-patch candidate on intrinsic severity and automatability, while recognizing no active exploitation is confirmed. Note the unusual protocol vector 'via SQL' in the description (versus 'via TCP' for the A:N siblings), which is atypical Oracle CPU phrasing and worth verifying against the vendor advisory. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Hyperion Financial Management Security component sends crafted requests over the SQL/network channel to bypass authentication and gain administrative control of the HFM instance. Because the flaw is low-complexity and requires no privileges or user interaction, and SSVC marks it Automatable=yes, an attacker could weaponize it into a repeatable script once details emerge. No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers with network access to Oracle Hyperion Financial Management 11.2.26.0.000 can bypass authentication in the product's Security component and take full control of the application, yielding complete confidentiality, integrity, and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitation requires no credentials and no user interaction, only reachability to the affected HFM instance's SQL-facing interface, which the SSVC assessment rates as fully automatable with total technical impact. There is currently no public exploit identified at time of analysis and no confirmed active exploitation, but the low attack complexity and unauthenticated vector make this a top-priority patching target wherever HFM is exposed beyond tightly segmented internal networks.
RemediationAI
No vendor-released patch version is specified in the available intelligence, so the immediate action is to retrieve and apply the applicable Oracle Critical Patch Update from the advisory at https://www.oracle.com/security-alerts/cspusep2026.html and confirm with Oracle Support whether the fix is delivered as a dedicated HFM patch, an EPM bundle, or an interim one-off for 11.2.26.0.000. Until that patch is applied, the highest-value compensating control is network isolation: because exploitation is unauthenticated and requires only reachability to the SQL-facing interface (AV:N/PR:N/AC:L), restrict access to the HFM service ports to the specific application, ETL, and administrative hosts that legitimately connect, and block those ports at perimeter and inter-VLAN boundaries - the trade-off is that legitimate remote consolidation clients and any externally integrated reporting tools must be re-homed or given explicit host-level allow-lists. Where the SQL interface must remain broadly reachable, place it behind an authenticated reverse proxy or VPN gateway with per-user authorization and log the source of every connection attempt; this adds a credential-bearing hop that changes client configuration and can break service accounts if not planned. Disable or firewall any unused HFM web/RMI endpoints, enforce least privilege on the HFM service account and its database DSN credentials so a bypass yields fewer downstream rights, and monitor HFM and database logs for anomalous pre-authentication requests, SQL statements issued without a prior session, or unexpected new administrative accounts - log review is detective only and will not stop a fast, automatable attack, so it should not substitute for patching or segmentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-287 (Improper Authentication) and resides in the Security component of Oracle Hyperion Financial Management, the financial-consolidation and statutory-reporting module of the Oracle Hyperion enterprise performance management (EPM) suite. Improper authentication means the application fails to correctly establish or verify the identity of a requester before granting access to protected functionality, so a request that should have been rejected is instead processed with the privileges of the target service. The Oracle advisory describes the attack path as 'via SQL', indicating the vulnerable surface is the component that accepts database/network requests rather than the browser UI, and that a crafted request reaching that interface can satisfy the component's authentication logic in the attacker's favor. Because the CVSS vector is PR:N and no privileges or user interaction are needed, the defect is reachable in a pre-authentication state; the same vector shows Scope:Unchanged, meaning the compromise stays within the HFM security context rather than escalating to the underlying database host, though within that context all three CIA properties are rated High. The only version confirmed affected in the available intelligence (EUVD and the Oracle advisory) is 11.2.26.0.000, and no CPE string or alternate affected build has been published, so defenders should treat subsequent HFM releases as unverified until Oracle confirms otherwise.
Know when Hyperion Financial Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthenticated network attacker easily achieves takeover with full C/I/A impact, matching AV:N/AC:L/PR:N/UI:N and CWE-287 pre-auth bypass; no cross-component scope change so S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Hyperion Financial Management 11.2.26.0.000 - the platform many organizations rely on for statutory consolidation, management reporting, and financial close - contains a critical authentication bypass that allows an unauthenticated attacker with network reach to seize full control of the application and everything it holds. Because HFM aggregates highly sensitive financial data and typically sits on the same network path as source ERP and database systems, a compromise could enable fraudulent reporting, mass exfiltration of financial records, and sustained disruption of the close process during a reporting period. Leadership should treat this as an enterprise-level exposure: the risk is concentrated in whichever HFM instances are reachable beyond tightly segmented internal networks, and no vendor patch is available to close the gap today.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately restrict network reachability to HFM instances and the SQL-facing interface to trusted hosts only; segment HFM into an isolated zone with no lateral path to ERP or financial databases; enforce least-privilege database and service accounts; enable and monitor authentication and Security component audit logs for anomalies; deploy WAF/IDS rules targeting authentication bypass against HFM endpoints; limit privileged HFM administration to a small, monitored group; and open an Oracle Support case to obtain an interim fix or patch timeline.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthen
Unauthenticated remote attackers can reach the Security component of Oracle Hyperion Financial Management 11.2.26.0.000
Privilege escalation to full takeover in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a
Authenticated takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is possible for an attacker who holds a val
Remote takeover of Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) allows an unauthenticated att
Unauthenticated remote takeover of Oracle Hyperion Financial Management 11.2.26.0.000 is achievable through an improper
Unauthenticated attackers with access to the same physical network segment as an Oracle Hyperion Financial Management 11
Oracle Hyperion Financial Management 11.2.26.0.000 can be fully taken over by an attacker who already holds a high-privi
Unauthorized data manipulation and full denial of service in Oracle Hyperion Financial Management 11.2.25.0.000 (Securit
Unauthenticated attackers who can reach the Oracle Hyperion Financial Management Security component over TCP can bypass
Exploit-DB